How to Read a Hemp COA — And How to Spot a Fake One

Every hemp product worth buying comes with a certificate of analysis. Almost nobody reads them, which is exactly why bad actors keep getting away with faking them.

A COA is a lab report. It tells you what is in the product and what is not. Learning to read one takes about five minutes and it is the single most useful skill in this entire industry — more useful than knowing strain names, more useful than knowing extraction methods.

Here is how.

What a COA is supposed to prove

Two things, and they are equally important:

1. What is in the product — the cannabinoid panel. Potency, and whether the delta-9 THC content is under the 0.3% federal limit.
2. What is not in the product — the contaminant panels. Pesticides, heavy metals, residual solvents, microbials, mycotoxins.

Most people only look at the first one. The second one is where the actual health risk lives.

The header: check this before anything else

Before you read a single number, verify four things at the top of the report:

The lab's name, and whether it is ISO 17025 accredited. This is the international standard for testing laboratory competence. An unaccredited lab's numbers are an opinion. Most legitimate reports state the accreditation and the certificate number directly on the page.

The batch or lot number. This has to match the number printed on the package in your hand. This is the check that catches most fraud. A brand can publish one genuinely good lab report and then attach it to every batch they sell forever. If the numbers do not match, the report tells you nothing about your product.

The sample date and report date. Cannabinoids degrade. A report from three years ago on a product you bought last week is not describing what you bought.

Who submitted the sample. Reports usually say "client-submitted" or similar. Client-submitted means the brand chose which sample to send. That is normal and not disqualifying, but it is a reason to weight the contaminant panels heavily — those are harder to game than potency.

The cannabinoid panel

You will see a table of cannabinoids with two or three columns, usually percentage by weight and mg/g or mg per unit.

Total THC and delta-9 THC are different numbers. This confuses almost everyone. THCA converts to delta-9 THC when heated. So labs report:

• Delta-9 THC — what is present in the product as sold
• THCA — the acidic precursor
• Total THC — usually calculated as delta-9 THC + (THCA × 0.877)

The 0.877 factor accounts for the mass lost when THCA decarboxylates. Federal hemp compliance is measured on delta-9 THC by dry weight, not total THC. This is why a THCA product can be federally compliant on paper while producing effects much like high-THC cannabis once you heat it. Whether you find that reassuring or alarming, you should at least know it is how the math works.

ND and <LOQ are not the same as zero. "ND" means not detected. "<LOQ" means present below the limit of quantification — the lab can see it but cannot reliably measure it. Both are fine. Neither means the compound is absent in an absolute sense.

The contaminant panels — the part that matters

This is where a COA earns its keep.

Residual solvents. Applies to any solvent-extracted product: live resin, distillate, liquid diamonds. You are looking for butane, propane, ethanol, and — most importantly — benzene, which is a known carcinogen and should never be present. All results should be well under the action limits printed alongside them.

A true solventless product like live rosin has no reason to carry a residual solvent panel. If it does and shows detections, ask questions.

Heavy metals. Lead, arsenic, cadmium, mercury. Two sources: the plant itself, which is a hyperaccumulator that pulls metals out of soil, and the vape hardware. Cheap cartridges leach lead from solder joints into the oil over time. A heavy metals panel run on the finished, filled device is far more meaningful than one run on the bulk oil before filling. Very few brands do the former. It is a strong quality signal when they do.

Pesticides. Myclobutanil is the one to know. It is a common fungicide that is relatively harmless to eat and produces hydrogen cyanide when combusted. Any detection in a product you are going to inhale is disqualifying.

Microbials and mycotoxins. More relevant for flower and edibles than for concentrates. Aspergillus is the significant one.

Five ways to spot a fake COA

Fraud in this category is common and mostly unsophisticated. Here is what to look for.

1. The batch number doesn't match. Already covered, and it is the number one tell. Check it every time.

2. The lab doesn't exist or the report isn't on their portal. Most accredited labs host reports themselves and provide a QR code or a lookup tool. Scan the code and see where it lands. A QR code that resolves to a PDF hosted on the brand's own domain rather than the lab's is a meaningful downgrade in trust — not proof of fraud, but not independent verification either.

3. Editable PDF fields or inconsistent fonts. Open the file and try to select the text of a number. Altered reports frequently show mismatched fonts, misaligned decimals, or numbers that sit slightly off the baseline of the surrounding row.

4. Only a potency panel, no contaminant panels. A full-panel test costs meaningfully more than a potency-only test. A brand publishing potency alone is either economizing or hiding something. Either way you learned something.

5. Numbers that are too clean. Real analytical results are messy — 87.34%, 0.021%. A report showing 90.00% total cannabinoids and 0.00% across every contaminant is describing a spreadsheet, not a lab instrument.

A 30-second version

If you only do one thing, do this:

1. Find the batch number on the package.
2. Find the batch number on the COA. Confirm they match.
3. Scan to the residual solvents panel. Confirm benzene is ND.
4. Check the report date is within the last 12 months.

That takes half a minute and eliminates most of the risk in this category.

Why we publish ours — and where our gaps are

We publish the lab reports for the brands we carry on our COA page. Not because it is required — for a lot of what we sell, it is not — but because the alternative is asking you to trust a logo.

It would be a bad look to write all of the above and then overstate our own position, so: our coverage is not complete yet. Some listings have a report for every flavor, some have one, and a few do not have one posted. We are working through the gaps. In the meantime, if you want the report for something you bought and cannot find it, email us and we will get it for you — and if a batch number doesn't line up with a report, tell us. We would rather hear it from you than not hear it at all.

That is the standard we would want you to hold any seller to, including us.

Browse everything we carry.

For adults 21 and over. Hemp products sold here contain less than 0.3% delta-9 THC by dry weight in compliance with the 2018 Farm Bill. These statements have not been evaluated by the Food and Drug Administration and are not intended to diagnose, treat, cure, or prevent any disease.